Malicious advertisement hosted by sponsoredads.com, Microsoft owned adecn.com involved in distribution
It never rains, but it pours malicious advertisements.
Ok, let's take a look at another malicious advertisement, this time found via www.youhide.com - and yes, it's another example a malicious skyauction.com advertisement.
As always, we work backwards, from the end target fraudware site to the source - first, for the malicious skyauction.com advertisement:
scanner2.malware-scan.com/5_swp/?tmn=null&aid=&lid=&affid=&ax=&ed=&aid=denouement_ma5_mb1&lid=468&affid=&ax=1&ed=2&mt_info=3958_0_11469
prevedmarketing.com/?tmn=mwatmp&aid=denouement&lid=468&ax=1&ed=2&mt_info=5028_3127_2358
blessedads.com/?cmpid=denouement&adid=468
newbieadguide.com/statss.php?campaign=denouement&u=23423424
All the same referrer:
newbieadguide.com/swf/gnida.swf?campaign=denouement&u=23423424
-----
newbieadguide.com/swf/gnida.swf?campaign=denouement&u=23423424
Referrer:
newbieadguide.com/statsg.php?u=23423424&campaign=denouement
-----
newbieadguide.com/statsg.php?u=23423424&campaign=denouement
newbieadguide.com/statsa.php?u=23423424&campaign=denouement
Both the same Referer:
sponsoredads.com/images/members/1248/468x60.swf (this is the malicious skyauction advertisement)
-----
sponsoredads.com/images/members/1248/468x60.swf
Referrer:
ad2.adecn.com/here.spot?v=2.2;time=119;spotId=10112;c=0;ms=1199702904472
-----
ad2.adecn.com/here.spot?v=2.2;time=119;spotId=10112;c=0;ms=1199702904472
Referrer:
youhide.com/nph-info.pl/000010A/687474703a2f2f7777772e796f75686964652e636f6d2f
(Note: adecn is owned by Microsoft - I know just who to contact):
cite:
http://www.adecn.com/assets/070727%20%20Microsoft%20Acquires%20Broker%20Of%20Ad%20Space,%20WSJ.pdf
Screenshot of malicious skyauction SWF:
